------- Forwarded message ------- From: [EMAIL PROTECTED] To: "VirusEye Subscriber" <[EMAIL PROTECTED]> Subject: WARNING: New Virus - LoveGate.C Date: Tue, 25 Feb 2003 09:23:44 GMT
On 24th February 2003, MessageLabs stopped several copies of a new variant of the LoveGate virus. Initial analysis suggests that this is a mass-mailing virus that incorporates an SMTP engine and a backdoor component.
The virus contains its own SMTP engine, which it uses to deliver its email. When activated, the virus may try to reply to any emails it finds in the recipient’s in-box, attaching itself to the email.
It also appears to be able to harvest passwords from the recipient’s machine, which may then be emailed to a number of email contacts.
The backdoor component may open TCP port 10168, allowing the machine to be controlled remotely. As well as the SMTP engine, it may also have the ability to spread via various network shares.
From the copies that MessageLabs have intercepted, the email may be composed as follows:
Subject names appear to be based on existing emails that are in reply, and therefore random.
The body-text may also contain, “I'll try to reply as soon as possible. Take a look to the attachment and send me your opinion!”
The file attachment is written in Microsoft Visual C/C++ and is compressed using ASPack and is 78,848 bytes in size. Attachment file names may include:
billgt.exe, card.exe, docs.exe, fun.exe, hamster.exe, humor.exe, images.exe, joke.exe, midsong.exe, news_doc.exe, pics.exe, pspgame.exe, s3msong.exe, searchurl.exe, setup.exe, tamagotxi.exe
More information may be found at: http://www.messagelabs.com/viruseye/report.asp?id=131
This email was sent to you because you subscribe to MessageLabs' Virus Alert service. You can cancel your subscription on the MessageLabs website at http://www.messagelabs.com/AlertUnsubscribe
MessageLabs is a leading provider of Internet-level managed email security services. Through its SkyScan portfolio of services, MessageLabs customers are protected from email-borne threats such as viruses, unsolicited mail and pornographic material, before such content comes anywhere near their network boundaries.
________________________________________________________________________ This email has been scanned for all viruses by the MessageLabs SkyScan service. For more information on a proactive anti-virus service working around the clock, around the globe, visit http://www.messagelabs.com ________________________________________________________________________
-- Euphorian
<A HREF="http://www.ctrl.org/";>www.ctrl.org</A> DECLARATION & DISCLAIMER ========== CTRL is a discussion & informational exchange list. Proselytizing propagandic screeds are unwelcomed. Substance�not soap-boxing�please! These are sordid matters and 'conspiracy theory'�with its many half-truths, mis- directions and outright frauds�is used politically by different groups with major and minor effects spread throughout the spectrum of time and thought. That being said, CTRLgives no endorsement to the validity of posts, and always suggests to readers; be wary of what you read. CTRL gives no credence to Holocaust denial and nazi's need not apply.
Let us please be civil and as always, Caveat Lector. ======================================================================== Archives Available at: http://peach.ease.lsoft.com/archives/ctrl.html <A HREF="http://peach.ease.lsoft.com/archives/ctrl.html";>Archives of [EMAIL PROTECTED]</A>
http://archive.jab.org/[EMAIL PROTECTED]/ <A HREF="http://archive.jab.org/[EMAIL PROTECTED]/">ctrl</A> ======================================================================== To subscribe to Conspiracy Theory Research List[CTRL] send email: SUBSCRIBE CTRL [to:] [EMAIL PROTECTED]
To UNsubscribe to Conspiracy Theory Research List[CTRL] send email: SIGNOFF CTRL [to:] [EMAIL PROTECTED]
Om
